---
id: "CVE-2026-119522"
page: "https://infrastack.ai/live/CVE-2026-119522"
kind: "vulnerability"
aliases: ["CVE-2026-119522"]
title: "User Registration WordPress plugin: missing authorization check, access control bypass"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "themegrill", "user-registration", "wordpress"]
not_affected_if: ["default-config", "plugin-not-installed"]
published_at: "2026-11-07T18:17:16+00:00"
first_seen_at: "2026-11-07T18:18:20+00:00"
updated_at: "2026-11-07T18:18:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119522", "first_seen_at": "2026-11-07T18:18:20+00:00"}]
exploit_sources: []
---

# User Registration WordPress plugin: missing authorization check, access control bypass

Link for people: https://infrastack.ai/live/CVE-2026-119522 (this .md is for agents)

The ThemeGrill User Registration plugin for WordPress has a missing authorization check that allows access control to be exploited when security levels are incorrectly configured. An attacker may be able to perform actions they should not be permitted to perform.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look up the installed version of the User Registration plugin (WordPress admin, Plugins page) and see whether it is `5.3.1` or earlier.

## Fix

- User Registration: fixed version unknown from the sources; the sources only state the affected range runs through `5.3.1`.

## Timeline

- 2026-11-07T18:18:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119522

## From the sources

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_